Detections
Analytics

SCA: security update for github.com/siyuan-note/siyuan/kernel (GHSA-c8r8-95hg-mp34)

medium Tenable Cloud Security Plugin ID 477634

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to
 restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can
 read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access other sensitive
 files like data/templates and data/snippets/conf.json. (CVE-2026-60083)

Solution

Update the github.com/siyuan-note/siyuan/kernel library and its related packages to version 0.0.0-20260808051406-3542530c505f or later.

See Also

https://github.com/advisories/GHSA-c8r8-95hg-mp34

Plugin Details

Severity: Medium

ID: 477634

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/27/2026

Updated: 10/27/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.66

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 4.5

Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:N/A:N

CVSS Score Source: CVE-2026-60083

CVSS v3

Risk Factor: Medium

Base Score: 4.9

Temporal Score: 4.3

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 4.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/27/2026

Vulnerability Publication Date: 8/22/2026

Reference Information

CVE: CVE-2026-60083

cwe: CWE-863